ZAP Scanning Report

The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:

script-src, script-src-elem, script-src-attr, style-src, style-src-elem, style-src-attr, img-src, connect-src, frame-src, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action

The directive(s): form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.

Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.

http://www.w3.org/TR/CSP2/

http://www.w3.org/TR/CSP/

http://caniuse.com/#search=content+security+policy

http://content-security-policy.com/

https://github.com/shapesecurity/salvation

https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources

The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content.

Provide a valid integrity attribute to the tag.

https://developer.mozilla.org/en/docs/Web/Security/Subresource_Integrity

A dangerous JS function seems to be in use that would leave the site vulnerable.

See the references for security advice on the use of these functions.

https://angular.io/guide/security

Feature Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Feature Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.

Ensure that your web server, application server, load balancer, etc. is configured to set the Feature-Policy header.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy

https://developers.google.com/web/updates/2018/06/feature-policy

https://scotthelme.co.uk/a-new-security-header-feature-policy/

https://w3c.github.io/webappsec-feature-policy/

https://www.smashingmagazine.com/2018/12/feature-policy/

The cache-control and pragma HTTP header have not been set properly or are missing allowing the browser and proxies to cache content.

Whenever possible ensure the cache-control HTTP header is set with no-cache, no-store, must-revalidate; and that the pragma HTTP header is set with no-cache.

https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching

Base64 encoded data was disclosed by the application/web server. Note: in the interests of performance not all base64 strings in the response were analyzed individually, the entire response should be looked at by the analyst/security team/developer(s).

Manually confirm that the Base64 data does not leak sensitive information, and that the data cannot be aggregated/used to exploit other vulnerabilities.

GIF89a\x0001\x0000\x0001\x0000\x0000�\x0000,\x0000\x0000\x0000\x0000\x0001\x0000\x0001\x0000\x0000\x0002\x0000;

http://projects.webappsec.org/w/page/13246936/Information%20Leakage

The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments.

Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.

The following pattern was used: \bSELECT\b and was detected in the element starting with: "(window.webpackJsonp=window.webpackJsonp||[]).push([[6],{"4R65":function(t,i,e){!function(t){"use strict";var i=Object.freeze;fu", see evidence field for the suspicious comment/snippet.

The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.

This is an informational alert and so no changes are required.

No links have been found while there are scripts, which is an indication that this is a modern web application.

The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where "shared" caching servers such as "proxy" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.

Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:

Cache-Control: no-cache, no-store, must-revalidate, private

Pragma: no-cache

Expires: 0

This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.

In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234.

https://tools.ietf.org/html/rfc7234

https://tools.ietf.org/html/rfc7231

http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html (obsoleted by rfc7234)

A timestamp was disclosed by the application/web server - Unix

Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.

63159454, which evaluates to: 1972-01-02 00:17:34

http://projects.webappsec.org/w/page/13246936/Information%20Leakage